mirror of
https://github.com/0xMarcio/cve.git
synced 2026-10-29 17:01:02 +00:00
0xMarcio
46b5acf052
Every writer now has a timeout, so a hung download cannot hold the repository-updates lock for six hours and cancel the runs queued behind it. The link audit moves from one 12,000-and-12,000 batch a week, which measured an hour under that lock, to a seventh of it every day. The social card PNG is drawn at deploy time and no longer committed: it changed about four times a day at 68 KB a copy. nuclei.json stops mirroring EPSS scores; every indexed CVE already has one in epss.json, the site never fell back to the copy, and the daily recomputation rewrote 3,400 lines of it each night. The metadata sync retries GitHub advisory calls on 403, 429 and 5xx instead of failing on the first one, and refuses to publish a year shard that an NVD feed would shrink by a tenth or delete outright.
103 lines
2.9 KiB
YAML
103 lines
2.9 KiB
YAML
name: Sync CVE Metadata
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '10 3 * * 1-6'
|
|
- cron: '10 3 * * 0'
|
|
workflow_dispatch:
|
|
inputs:
|
|
full:
|
|
description: Rebuild NVD and the reviewed GitHub advisory cache
|
|
required: false
|
|
default: false
|
|
type: boolean
|
|
|
|
permissions:
|
|
contents: write
|
|
actions: write
|
|
|
|
concurrency:
|
|
group: repository-updates
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
sync:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 60
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.13'
|
|
|
|
- name: Pull CVSS, advisory and advisory PoC metadata
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
if [ "${{ github.event.schedule }}" = "10 3 * * 0" ] || [ "${{ inputs.full }}" = "true" ]; then
|
|
python3 scripts/sync_cve_metadata.py --full
|
|
else
|
|
python3 scripts/sync_cve_metadata.py
|
|
fi
|
|
|
|
- name: Refresh CISA known-exploited status
|
|
run: python3 scripts/audit_poc_links.py --kev-only
|
|
|
|
- name: Verify the generated index
|
|
run: |
|
|
python3 -m unittest discover -s tests
|
|
python3 scripts/build_site.py
|
|
|
|
- name: Refresh published counts
|
|
run: |
|
|
python3 .github/hero.py
|
|
python3 .github/getTrending.py --counts-only
|
|
|
|
- name: Check for changes and commit
|
|
id: commit
|
|
run: |
|
|
git config user.name 'CVE-BOT'
|
|
git config user.email '[email protected]'
|
|
git add -- \
|
|
README.md \
|
|
cves/ \
|
|
docs/hero.svg \
|
|
docs/social-card.svg \
|
|
docs/stats.json \
|
|
docs/kev.svg \
|
|
index/cve_dates.json \
|
|
index/cve_record_state.json \
|
|
index/github_advisories.json \
|
|
index/kev.json \
|
|
index/metadata/ \
|
|
index/references.txt
|
|
|
|
if git diff --cached --quiet; then
|
|
echo "No changes to commit"
|
|
exit 0
|
|
fi
|
|
|
|
git commit -m "Sync CVE metadata $(date -u +'%Y-%m-%d')"
|
|
|
|
for attempt in 1 2 3; do
|
|
if git push origin HEAD:main; then
|
|
echo "pushed=true" >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
echo "Push rejected; replaying onto the current main (attempt $attempt)"
|
|
git fetch --unshallow origin main 2>/dev/null || git fetch origin main
|
|
git rebase FETCH_HEAD || { git rebase --abort; exit 1; }
|
|
done
|
|
exit 1
|
|
|
|
# Commits pushed with the workflow token raise no push event, so site.yml
|
|
# would otherwise wait for its daily schedule. Dispatching is exempt.
|
|
- name: Rebuild and deploy the site
|
|
if: steps.commit.outputs.pushed == 'true'
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: gh workflow run site.yml --ref main
|